Listen to this Post
How the CVE Works
CVE-2025-48206 is an XSS vulnerability in the ns_backup extension (up to v13.0.0) for TYPO3. The flaw occurs due to improper input sanitization in user-supplied data processed by the extension. Attackers can inject malicious JavaScript via crafted backup filenames or metadata, which executes when an admin views the backup logs or management interface. This allows session hijacking, phishing, or privilege escalation within the TYPO3 backend.
DailyCVE Form
Platform: TYPO3
Version: ≤13.0.0
Vulnerability: Stored XSS
Severity: Medium
Date: 2025-06-25
Prediction: Patch by 2025-08-15
What Undercode Say
Analytics:
grep -r "ns_backup" /typo3/ext/ curl -X POST -d "malicious_payload" http://target/typo3/ns_backup
Exploit:
<script>alert(document.cookie)</script>
Protection from this CVE:
- Disable ns_backup
- Input sanitization
Impact:
- Backend compromise
- Session theft
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
